AZ-400 Design and implement build and release pipelines Practice Test 3 — 15 Questions

Question 1

You are configuring a release pipeline in Azure Pipelines for a Java application. The pipeline must run integration tests after deployment to a test environment and only proceed to production if tests pass. Which THREE should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a pipeline condition on the production stage to run only if the test stage succeeded.. To run integration tests after deployment to a test environment and only proceed to production if tests pass, configure a pipeline condition on the production stage to run only if the test stage succeeded (A) and add a post-deployment gate that queries Azure Monitor for test failure signals (D). Option E is incorrect because a post-deployment approval on the production stage occurs after the production deployment has already happened, so it does not prevent the deployment. Option B is incorrect because agent jobs run on agents, not directly on environments. Option C is incorrect because the integration test step should run after deployment, not based on the previous build success.

Answer

Set the agent job to run on the environment itself.

Answer

Set the integration test step to run only if the previous build succeeded.

Answer

Configure a post-deployment approval for the production stage.

Question 2

Which TWO triggers can be used to automatically start a pipeline in Azure Pipelines? (Choose two.)

Accepted Answer

Continuous integration (CI) trigger. Azure Pipelines supports CI, PR, Scheduled, and Webhook triggers as automatic mechanisms. The question asks for two but does not restrict the context, leaving four valid options. Therefore, any pair of these four could be correct, making the marked answer not the only correct one. The question should be rephrased to focus on a specific trigger type (e.g., code-event triggers) or should have only two correct options.

Answer

Manual trigger

Question 3

Your organization uses Azure Pipelines to build and deploy a .NET Core application to Azure App Service. The build pipeline takes 15 minutes. You want to implement continuous integration (CI) triggers but only for changes to the 'src' folder. The repository is in Azure Repos. How should you configure the trigger?

Accepted Answer

Set trigger: paths: include: - 'src/*'. Azure Pipelines path filters use glob patterns. The pattern '*' matches zero or more characters but does not match the slash '/', so 'src/*' only matches files directly in the 'src' folder, not files in subdirectories. To include all files under 'src' (including subfolders), you must use 'src/**'. The correct YAML would be: trigger: paths: include: - 'src/**'. Option A is not fully correct because it would miss changes in subfolders.

Answer

Set trigger: paths: exclude: - 'src/*'

Answer

Set trigger: branches: include: - main

Answer

Set trigger: batch: true

Question 4

Which THREE components are required to implement a GitHub Actions self-hosted runner on a Windows virtual machine? (Choose three.)

Accepted Answer

GitHub Actions runner application installed on the VM. To run a GitHub Actions self-hosted runner on a Windows VM, you need the GitHub Actions runner application installed on the VM and a Windows OS. A PAT is not required for registration; GitHub provides a short-lived registration token, and a PAT is only needed if you generate that token via the API. IIS and Docker are not prerequisites.

Answer

A personal access token (PAT) for registering the runner

Answer

IIS (Internet Information Services) running on the VM

Answer

Docker Desktop installed on the VM

Question 5

What is the most likely cause of this error?

Accepted Answer

The secret name in Key Vault does not match 'myKeyVaultSecret'. The question asks for the cause of an error but the error text is missing. Without the specific error message, none of the options (A, B, C, or D) can be definitively determined as correct. The marked answer C is only plausible if the error explicitly states that the secret is not found, but that is not provided. The stem must include the error message for the question to be valid.

Answer

The variable group is not linked to the Key Vault

Answer

The service connection does not have 'Get' permission on the Key Vault

Answer

Pipeline variables cannot reference Key Vault secrets

Question 6

You are designing a multi-stage YAML pipeline that deploys to multiple environments. You need to ensure that the pipeline can be triggered manually for a specific stage without running previous stages. Which feature should you use?

Accepted Answer

Use the 'Run pipeline' button with 'Stages to run' and set 'stagesToSkip' parameter. To manually run a specific stage in a multi-stage YAML pipeline, use the Run pipeline button and select the desired stage(s) from the 'Stages to run' dropdown in the UI. The 'stagesToSkip' parameter is not used in the UI; it is only applicable when triggering a run via the REST API. Therefore, Option A should be reworded to remove the reference to 'stagesToSkip'.

Answer

Use 'condition: always()' on the stage

Answer

Use 'dependsOn: []' to make the stage independent

Answer

Use 'trigger: none' at the stage level

Question 7

Which THREE are valid deployment strategies supported by Azure Pipelines and GitHub Actions? (Choose three.)

Accepted Answer

Blue-green. Azure Pipelines provides built-in deployment strategy definitions for blue-green, canary, and rolling in YAML pipelines. These same strategies can be implemented in GitHub Actions using Azure deployment actions (e.g., Azure App Service slots for blue-green, traffic splitting for canary, and multi-environment jobs for rolling). All three maximize uptime and simplify rollback, making them valid supported strategies. Immutable and recreate are not built-in strategies in Azure Pipelines and are not commonly used as deployment strategy definitions for these platforms.

Answer

Immutable

Answer

Recreate

Question 8

Refer to the exhibit. The pipeline will trigger when changes are pushed to which branches?

Accepted Answer

The main branch and any branch starting with 'release/'. The pipeline trigger configuration uses a YAML `trigger` block with `branches` and `include` clauses. The `include` list specifies that the pipeline triggers on pushes to the `main` branch and any branch matching the wildcard pattern `release/*`. This is why option B is correct: the pipeline triggers on both the main branch and all branches starting with 'release/'.

Answer

All branches

Answer

Only the main branch

Answer

Only branches starting with 'release/'

Question 9

Which TWO actions should you take to ensure that a build pipeline fails if code coverage drops below 80%?

Accepted Answer

Add a script task that parses the coverage file and exits with non-zero if below threshold.. Only option B directly enforces the threshold by parsing coverage and exiting non-zero. Option C merely publishes results and does not enforce a threshold. Therefore the question as written cannot have two correct answers.

Answer

Use the PublishTestResults@2 task with the 'codeCoverage' option.

Answer

Use the PublishCodeCoverageResults@1 task to publish coverage data.

Answer

Use the ReportGenerator@5 task to create a coverage report.

Answer

Use the CopyFiles@2 task to move coverage files to a shared location.

Question 10

You are troubleshooting a release pipeline that deploys an ARM template to Azure. The deployment fails with the error 'The subscription '...' could not be found.' The service connection used has Contributor permissions on the subscription. The pipeline runs successfully from the Azure DevOps portal when triggered manually. What is the likely cause?

Accepted Answer

The service principal used by the service connection is not authorized in the subscription.. The error 'The subscription '...' could not be found' occurs when the service principal associated with the service connection does not have a valid role assignment at the subscription scope. Even if the service connection is configured with Contributor, the actual app registration may lack the role, or the role assignment may be missing due to tenant mismatches. Manual runs might succeed because they could use a different service connection or a user with explicit access, but automated runs consistently use the service principal and fail.

Answer

The service connection does not have sufficient permissions.

Answer

The subscription has been deleted.

Answer

The deployment is targeting a resource group in a different region.

Question 11

Which TWO conditions must be met to use the 'Approvals and gates' feature in a release pipeline? (Choose two.)

Accepted Answer

A pre-deployment approval must be configured.. The prerequisite for using approvals and gates is that you must configure at least one approval (pre-deployment or post-deployment) for a stage. If you intend to use gates, you also need a service connection to query the external service. However, the available options do not include 'an approval must be configured' as a single choice; instead, they split it into two specific types, neither of which is individually required. The correct answer cannot be determined from the provided options.

Answer

A manual intervention task must be added.

Answer

A post-deployment approval must be configured.

Answer

A variable group must be linked to the pipeline.

Question 12

Which THREE are benefits of using 'Environment' resources in YAML pipelines compared to classic release pipelines? (Choose three.)

Accepted Answer

Environments provide a dashboard showing the deployment history and resource health.. Environments in YAML pipelines provide a centralized dashboard that shows deployment history and resource health, enabling monitoring and tracking over time (A). They also support checks such as approval gates and manual intervention, which allow you to control deployments before they proceed (C). Additionally, environments can represent Kubernetes namespaces and automatically track which versions are deployed to each namespace, giving richer deployment tracking than classic release pipelines (E).

Answer

Environments can only be used in classic release pipelines.

Answer

Environments allow you to define pre-deployment and post-deployment gates using the classic release pipeline interface.

Question 13

You are setting up a release pipeline for an ASP.NET Core application that is deployed to Azure App Service (Windows). The application uses Entity Framework Core for database migrations. You need to automate the execution of database migrations during deployment, ensuring that the migrations run only once and that the application is not started until the migration completes. You also need to handle rollback in case the migration fails. The pipeline should deploy to staging slot, run migrations, swap to production, and then run post-swap migrations if needed. Currently, the pipeline deploys the code and then runs a script to execute 'dotnet ef database update'. However, during swap, the staging slot's migrations may conflict with production. What is the recommended architecture for handling database migrations with zero-downtime deployment?

Accepted Answer

Use Idempotent migrations and run them in the staging slot before swap. Then, after swap, run migrations again in the production slot to ensure any remaining changes are applied.. Using idempotent migrations (EF Core tracks applied migrations) allows running them multiple times without duplicate effects. Running migrations in the staging slot before swap updates the shared database schema while production is still running the old code; this is safe if pre-swap migrations are backward-compatible. After the swap, running migrations again in the production slot applies any remaining post-swap migrations (e.g., data changes requiring the new code) without downtime. Option B is wrong because it omits the post-swap step, which may be required for changes that can only be applied after the new code is live. Option C causes downtime by stopping the app. Option D adds manual intervention and does not ensure zero-downtime.

Answer

Run migrations only in the staging slot before swap. After swap, the production slot will use the new schema automatically.

Answer

Run migrations only after the swap is complete, in the production slot. The application is stopped during migration to avoid errors.

Answer

Disable automatic migration execution in the pipeline. Instead, have a separate manual process to run migrations using a dedicated tool.

Question 14

Your team is migrating from Jenkins to Azure Pipelines. You have a Jenkins pipeline that builds a Java application, runs unit tests, performs static code analysis with SonarQube, packages the application as a WAR file, and deploys to a Tomcat server. You need to replicate this pipeline in Azure Pipelines using YAML. The build and deployment must be triggered by commits to the main branch. You also need to ensure that the SonarQube analysis results are published to the SonarQube server and that the pipeline breaks if the quality gate fails. The Tomcat server is on-premises and requires a service connection. Which YAML pipeline structure should you use?

Accepted Answer

Use the Maven task with SonarQube goals (sonar:sonar) for analysis, then use the Copy Files task and Windows Machine File Copy task to deploy to the on-premises Tomcat server.. The correct answer is B only if the Tomcat server is Windows and the Maven task is configured with sonar.qualitygate.wait=true or paired with a SonarQubePublish task to enforce the quality gate. The stem should explicitly state the Tomcat server runs on Windows to justify the use of Windows Machine File Copy. If Tomcat runs on Linux, option D would be more appropriate for deployment, but it lacks SonarQube analysis.

Answer

Use the Maven task to build and test, and use the Azure Web App task to deploy to Azure App Service.

Answer

Use the Maven task to build, then use PowerShell to copy the WAR file to the Tomcat server via Invoke-Command.

Answer

Use the Maven task to build and test, and use SSH tasks to copy the WAR file to the Tomcat server and restart the service.

Question 15

You are setting up a build pipeline for a Node.js application that uses npm for package management. The pipeline should restore npm packages on every build, but you want to leverage caching to speed up the process. The pipeline runs on a Microsoft-hosted agent. You also need to ensure that the build fails if any npm audit vulnerabilities are found. Which tasks and configuration should you use?

Accepted Answer

Use the 'npm' task with 'install' command and enable caching by setting the 'workingDirectory' variable. Run a separate 'npm' task with 'audit' command and set 'failOnVulnerabilities' to 'true'.. The correct configuration should use npm ci (via the npm task's 'ci' command or a custom command), cache the npm cache directory (e.g., $(npm_config_cache)) using the Cache task with a key derived from package-lock.json, and include a separate step that runs npm audit and fails the build on vulnerabilities by checking the exit code. Option D is invalid because it references nonexistent Azure DevOps task properties, uses 'install' instead of 'ci', and does not describe proper caching. Since no provided option matches this correct approach, the question has no valid answer.

Answer

Use the 'npm' task with 'custom' command to run 'npm ci'. Use the 'Cache' task to cache 'node_modules' with a key based on 'package.json'.

Answer

Use the 'npm' task with 'install' command without caching. After install, run a PowerShell script to run 'npm audit --audit-level=high' and parse the output.

Answer

Use the 'npm' task with 'ci' command and set 'ignoreScripts' to true. Add a 'npm audit' task but set 'failOnVulnerabilities' to 'false' to avoid build failures.